From b930fe04cee92cd4723044030bb59c36781c7137 Mon Sep 17 00:00:00 2001 From: Erik Michelson Date: Tue, 3 Feb 2026 21:49:35 +0100 Subject: [PATCH] fix(security): increase CSP policy by explicitly sandboxing uploads Adding the sandbox attribute tells browsers to apply stricter restrictions like preventing execution of plugins and scripts. Signed-off-by: Erik Michelson --- app.js | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app.js b/app.js index 34a4e1a7..d41d433f 100644 --- a/app.js +++ b/app.js @@ -159,7 +159,7 @@ app.use(i18n.init) // security headers for uploads app.use('/uploads', (req, res, next) => { res.set('Content-Disposition', 'attachment') - res.set('Content-Security-Policy', "default-src 'none'") + res.set('Content-Security-Policy', "default-src 'none'; sandbox") next() })